Bybit Hack Explained: How a Tampered Frontend Stole $1.5B
Quick answer. Attackers compromised a Safe{Wallet} developer's laptop and planted JavaScript in Safe's AWS S3 bucket. On February 21, 2025, it showed Bybit's signers a routine transfer while they signed away an Ethereum cold wallet: about $1.5B, per the FBI.
Video transcript
The Bybit hack did not break a smart contract. The signers approved a transaction on a page that showed one thing and signed another.
The FBI put the theft at about 1.5 billion dollars and attributed it to North Korea. Bybit's own count is 1.46 billion.
It began at Safe, the wallet provider. A developer's laptop was compromised, AWS session tokens were hijacked, and JavaScript was planted in Safe's S3 bucket. Two days later, it altered Bybit's transfer during signing.
Bybit's CEO said every signer saw a masked interface showing the correct address, on a Safe URL.
What they signed was a delegatecall. It wrote an attacker address into the wallet's implementation slot, adding a hidden sweep function used to drain it.
Safe says forensics found no vulnerabilities in its smart contracts. The attack lived in a laptop, cloud credentials, a storage bucket and a signing screen. That takes offchain testing.
Each link has a control. Separate devices for production access. Short cloud sessions. Alerts on changes to served files. Decode calldata away from the interface, and refuse delegatecalls to unknown targets.
Guardian tests the path to your signatures, from what signers see to the cloud that serves them. Read the full breakdown, or talk to Guardian at guardian.security.
The Bybit hack did not break a smart contract. The contracts executed a transaction that Bybit's own signers had approved.
What failed was the page they approved it on. Investigators traced it back to one laptop at Safe, the wallet provider.
What Happened and What Was Lost
Bybit was moving ETH from a multisig cold wallet to a warm wallet. A routine transfer, it says, became a takeover.
| Date (UTC) | Event | Source |
|---|---|---|
| Feb 4, 2025 | A Safe developer's Mac is reportedly compromised | The Hacker News |
| Feb 19 | Malicious JavaScript appears in Safe{Wallet}'s S3 files | Sygnia |
| Feb 21, 13:30 | Bybit starts a routine cold-to-warm transfer | Bybit |
| Feb 21, 14:13 | The malicious transaction executes onchain | Bybit, Etherscan |
| Feb 21, 14:15 | Clean files replace the malicious JavaScript | Sygnia |
| Feb 22, 01:08 | Safe says Safe{Wallet} is paused for review | Safe |
| Feb 26 | FBI attributes the theft to North Korea | FBI |
| Mar 6 | Safe shares Mandiant's preliminary findings | Safe |
The figures differ by source:
| Source | Loss | Detail |
|---|---|---|
| FBI | About $1.5B | Public service announcement, February 26, 2025 |
| Bybit | $1.46B | 401,347 ETH, 90,375 stETH, 15,000 cmETH, 8,000 mETH |
| DefiLlama | $1.4B | About half of its $2.72B total for 2025 |
Bybit's timeline called it "the largest in the industry to date." DefiLlama now ranks it third, behind Binance (October 2026) and LuBian (2020).
Bybit says only one cold wallet was affected, client assets stayed backed 1:1 and withdrawals were never halted.
The Compromised Developer Machine
The attack began at Safe, not Bybit. Safe's February 26 statement says it was "achieved through a compromised machine of a Safe{Wallet} developer resulting in the proposal of a disguised malicious transaction."
Its March 6 update, with Mandiant, added detail:
- A developer's laptop ("Developer1") was compromised.
- The attacker hijacked AWS session tokens to bypass multi-factor authentication.
- That developer was one of very few staff with higher access.
- The attacker removed their malware and cleared Bash history.
The Hacker News reported that the Mac was compromised on February 4, 2025, after the developer downloaded a Docker project, likely through social engineering.
The FBI calls the activity TraderTraitor. Safe says Mandiant tracks the group behind it as UNC4899. Our guide to social engineering of multisig signers covers how these lures work.
Tampered Code in Safe's Cloud Bucket
Bybit hired Sygnia and Verichains to investigate. Sygnia examined all three signers' machines and found the tampered JavaScript in each browser cache.
Its interim report of February 25, 2025 found:
- The source: malicious JavaScript in a file served from Safe{Wallet}'s AWS S3 bucket.
- The timing: the file was last modified on February 19, two days before the theft.
- The purpose: to change the content of the transaction during signing.
- The trigger: it ran only for Bybit's contract and one other, likely an attacker test contract.
- The cleanup: clean files went up at 14:15:13 and 14:15:32 UTC, about two minutes later.
Public web archives held two snapshots from February 19: one clean, one with the malicious code.
Verichains reached the same view. "The attack specifically targeted Bybit by injecting malicious JavaScript into app.safe.global," it said, as BleepingComputer reported.
Bybit says neither firm found any compromise of its own infrastructure.
What the Signers Approved
Bybit CEO Ben Zhou said "all the signers saw the masked UI which showed the correct address and the URL was from Safe," as Rekt reported.
Safe confirmed that a malicious transaction "that had all valid signatures was executed onchain." Decoded from the chain, that transaction read:
| Field | What was signed |
|---|---|
| to | 0x9622...7242, an attacker contract |
| value | 0 |
| operation | 1, a delegatecall |
| data | A token "transfer" of zero to 0xbdd0...9516 |
A delegatecall runs the target's code on the Safe's own storage. Safe's proxy reads its implementation address from storage slot 0.
The "transfer" wrote 0xbdd0...9516 into that slot. As of November 2026, slot 0 of the drained wallet still holds it.
Rekt describes it as "a wallet implementation upgrade containing malicious code," with a hidden sweep function the attacker then used to drain it.
DefiLlama says signers were tricked "into blind-signing a masked transaction." Our explainer on what blind signing is covers why devices often cannot show this.
Why an Audit Would Miss It
Safe says the forensic review found no vulnerabilities in its smart contracts or in the source code of its frontend and services.
The contracts did their job: they checked valid signatures and executed. The attack lived in places a contract audit never reads:
- A developer laptop.
- Hijacked AWS session tokens.
- A JavaScript file in a storage bucket, live for two days.
- A signing screen that did not match the payload.
Those need offchain testing: infrastructure, web app and signer operational security. See our guide to wallet frontend security after Bybit.
Controls That Close Each Step
Each link in the chain has a control that targets it:
| Step in the attack | Control |
|---|---|
| Developer laptop compromised | Separate devices for production access; no untrusted projects |
| AWS session tokens hijacked | Short session lifetimes and device checks on cloud access |
| S3 JavaScript swapped | Tight write access; alert on any change to served files |
| Signers shown a fake transaction | Recompute hashes and decode calldata away from the interface |
| Delegatecall swaps the implementation | Refuse operation 1 to unknown targets; alert on slot 0 changes |
The tampered file was live for about two days. An alert on any change to served files gives a team that window to act.
Safe has since added detection that flags master copy upgrades. It also now offers Safe Utils, a community tool for verifying transaction hashes independently.
For signers, our guide to verifying a Safe transaction walks through each check.
Offchain compromises did not stop with Bybit. DefiLlama files Binance's October 2026 loss, the largest in its dataset, under Frontend & Infrastructure; see our Binance hack explainer.
How Guardian Helps
Guardian's institutional practice specifies trust boundaries, privileged roles, approval thresholds and key custody "before they are built rather than audited after."
An OpSec audit tests what a signer actually sees before approving, and what it takes to slip a malicious payload past them.
Guardian's infrastructure pentest covers cloud IAM, build and deploy, and the vendor consoles that can change production.
After launch, Managed Security reviews every multisig transaction before it is signed.
Frequently Asked Questions
How did the Bybit hack happen?
Attackers compromised a Safe{Wallet} developer's laptop and planted JavaScript in Safe's AWS S3 bucket. On February 21, 2025, it showed Bybit's signers a routine transfer. They actually signed a delegatecall that replaced the cold wallet's implementation.
How much was stolen in the Bybit hack?
About $1.5 billion, per the FBI. Bybit put the loss at $1.46 billion: 401,347 ETH, 90,375 stETH, 15,000 cmETH and 8,000 mETH. DefiLlama lists $1.4 billion.
Who was behind the Bybit hack?
The FBI attributed it to North Korea on February 26, 2025, and calls the activity TraderTraitor. Safe says Mandiant, which tracks the group as UNC4899, confirmed that attribution.
Were Safe's smart contracts hacked?
No. Safe says the forensic review found no vulnerabilities in its smart contracts. The contracts executed a transaction that carried valid signatures. The compromise sat in a developer laptop, AWS credentials and the JavaScript served to signers.
Sources
- FBI (IC3): North Korea Responsible for $1.5 Billion Bybit Hack (February 26, 2025)
- Bybit: Bybit Security Incident, Timeline of Events and FAQs (March 3, 2025)
- Bybit: Bybit Confirms Security Integrity Amid Safe{Wallet} Incident (February 26, 2025)
- Sygnia: Bybit Interim Investigation Report, via Bybit's forensic report folder (February 25, 2025)
- Safe: Update on Safe{Wallet} Restart (X, February 22, 2025)
- Safe: Safe{Wallet} Statement on Targeted Attack on Bybit (X, February 26, 2025)
- Safe: Investigation Updates and Community Call to Action (X, March 6, 2025)
- BleepingComputer: Lazarus hacked Bybit via breached Safe{Wallet} developer machine (February 26, 2025)
- The Hacker News: Safe{Wallet} Confirms North Korean TraderTraitor Hackers Stole $1.5 Billion in Bybit Heist (March 7, 2025)
- Rekt: ByBit, Rekt (February 22, 2025)
- Etherscan: Bybit cold wallet execTransaction, block 21895238 (February 21, 2025)
- Safe on GitHub: SafeProxy.sol, v1.4.1
- DefiLlama: Hacks dataset API (read November 5, 2026)
Test the path to your signatures
Guardian tests the devices, cloud accounts and signing screens between your team and a valid signature, before an attacker does.